Secure Access EUVD-2026-115452

Exploitation requires an administrator with an active authenticated session to the Secure Access server (version 14.60) management interface to be tricked into triggering an attacker-crafted request (UI:P in the CVSS vector reflects this passive user interaction). The core enabling condition is a bypassed/ineffective anti-CSRF security control on the account-creation function, so the server must be running the affected build with that control in place. Limiting factors that reduce realistic risk: the attack cannot succeed without the admin's live session and interaction, it cannot be performed purely by a remote attacker acting alone, and it is scoped to the specific affected version; it is not self-propagating or automatable without a human admin in the loop.

Signals are mixed and should be read carefully. The input assigns a high CVSS 4.0 base of 9.4 and a vuln.today Decision label of act_now, which argues for prompt remediation. However, the CVSS vector itself tempers this: although AV:N/AC:L/PR:N indicate a remotely reachable, low-complexity, unauthenticated vector, UI:P means exploitation is not self-contained - it depends on a privileged user (an admin) performing an action, which is inherent to CSRF. There is no CISA KEV listing, no EPSS probability supplied, and no public exploit reference in the input, so exploitation status is 'no public exploit identified at time of analysis.' This creates a notable tension: the act_now label and 9.4 score suggest urgency, but there is no supplied evidence of active or probable exploitation to corroborate it, and the CSRF mechanism requires a logged-in admin to be socially engineered. Net assessment: this is a genuinely serious flaw because a successful attack yields an attacker-controlled account (potential full compromise of the Secure Access server), but real-world risk is gated by the need for admin interaction rather than being wormable or automatable. Because the Decision label is act_now, treat remediation as high priority despite the absence of KEV/EPSS/POC data.

An attacker crafts a malicious web page (or email link) that silently submits a forged account-creation request to the Secure Access server's administrative interface. When an authenticated administrator with an active session visits the page, the bypassed CSRF protection allows the request to succeed, creating a new account under the attacker's control. No public exploit code is identified in the available data; the attack relies on the admin having a live session and being lured to attacker content.